AZ-104 Exam Guide: Azure Administrator Associate

AZ-104 (Azure Administrator Associate) is Microsoft's core role-based certification — the Azure equivalent of a sysadmin credential and the most-taken Azure associate exam. ~40–60 questions in 100 minutes, $165 USD, passing score 700/1000. Unlike AZ-900's vocabulary focus, AZ-104 tests real administrative capability: configuring RBAC, deploying VMs and networks, managing storage, and operating monitoring — expect scenario questions that assume you've used the Azure portal, CLI, and PowerShell.

Exam format

• ~40–60 questions in 100 minutes (plus case-study blocks that eat time)
• $165 USD (regional pricing applies)
• Passing score: 700/1000
• Question types: multiple choice, multiple response, drag-and-drop, ordering, hot-area, and hands-on-flavored case studies
• Prerequisite in practice: AZ-900-level fundamentals, though not formally required

The five domains

AZ-104's domain weights shift with exam updates, but the current shape is:

• Manage Azure identities and governance (~15–20%): Entra ID users/groups, RBAC, policy, management groups
• Implement and manage storage (~15–20%): storage accounts, redundancy, files, secure access
• Deploy and manage Azure compute (~20–25% — biggest): VMs, scale sets, App Service, containers, ARM deployments
• Implement and manage virtual networking (~15–20%): VNets, NSGs, peering, DNS, load balancing, hybrid
• Monitor and maintain Azure resources (~10–15%): Monitor, alerts, Backup, Site Recovery

Domain 1 — Identities and governance

Beyond AZ-900's 'what is Entra ID', AZ-104 asks you to OPERATE it: create users/groups (assigned vs dynamic), configure guest access, understand administrative units, and know the licensing gates (dynamic groups, Conditional Access = P1; PIM, Identity Protection = P2). RBAC gets operational depth — built-in roles, custom roles, scope inheritance, and the additive-permission model. Governance: policy definitions vs initiatives, remediation tasks, management group hierarchy, locks, tags, and moving resources between groups/subscriptions.

Domain 2 — Storage

Administrative storage: account kinds and what each enables (GPv2, FileStorage premium, BlockBlobStorage), redundancy options (LRS/ZRS/GRS/RA-GRS/GZRS) and their failover behavior, access tiers plus lifecycle management automation, soft delete and versioning. Access control depth: account keys vs SAS (service/account/user-delegation) vs stored access policies vs Entra-based auth for files. Azure Files specifics — file shares, NTFS ACLs via identity auth, File Sync with cloud tiering. Plus the tooling: AzCopy, Storage Explorer, Import/Export.

Domain 3 — Compute (the heavyweight)

VMs thoroughly: sizes/series, availability options (sets/fault domains, zones), managed disks, images, extensions (custom script, DSC), Run Command, Bastion. Scale sets — uniform vs flexible orchestration. App Service: plans and their tier limits, deployment slots/swaps, scaling, networking integration. Containers: ACI vs AKS positioning (you don't need deep Kubernetes, but know when each service applies). ARM templates and Bicep at a 'read and deploy' level — deployment modes (incremental vs complete) are a favorite trap.

Domain 4 — Virtual networking

The most failure-prone domain for candidates without network background: VNet/subnet CIDR planning, peering (non-transitive! global peering, gateway transit), NSGs (priority order, ASGs, default rules), route tables/UDRs, Azure DNS public + private zones with VNet links. Load balancing portfolio: Load Balancer (L4) vs Application Gateway (regional L7 + WAF) vs Front Door (global L7) vs Traffic Manager (DNS). Connectivity: VPN Gateway S2S/P2S, ExpressRoute, VNet-to-VNet. Diagnostics: Network Watcher tools (IP flow verify is the star), NSG flow logs, connection monitor.

Domain 5 — Monitoring and backup

The lightest domain but detail-dense: metrics vs logs (when each, KQL basics), alert rules + action groups + alert processing rules, Activity Log vs diagnostic settings vs resource logs, VM insights and the AMA agent. Data protection: Recovery Services vault, backup policies (schedule + retention), VM/file-share/backup-restore flows, soft delete for backups. Site Recovery: replication, failover/failback — and the conceptual line between backup (data protection) and ASR (business continuity).

Who should take it — and how it compares

AZ-104 is for Azure administrators, cloud engineers, and anyone building toward architecture/security Azure roles. Compared to AWS SAA-C03: AZ-104 is more operational (configure X, fix Y) while SAA is more design-flavored (choose the architecture). If you hold SAA, much of the infrastructure vocabulary maps over — but Azure's identity/governance and networking naming require dedicated study. Plan 4–8 weeks of prep with real portal time.